28 Jan 2022, 09:00

The Privacy Commissioner intervened in the 2021 High Court judicial review proceedings in relation to Te Pou Matakana Limited's requests to the Ministry of Health for the disclosure of Māori vaccination information.

Te Pou Matakana Limited v Attorney-General (No 1) [2021] NZHC 2942 (WOCA 1).

Download a PDF version of the High Court's decision here.

Download a PDF version of the Privacy Commissioner's submissions here.

Te Pou Matakana Limited v Attorney-General (No 2) [2021] NZHC 3319 (WOCA 2).

Download a PDF version of the High Court's decision.

Download a PDF version of the Privacy Commissioner's submissions here.

Overview

Te Pou Matakana, is a commissioning agency of Whānau Ora and trades under the name Whānau Ora Commissioning Agency (WOCA). Te Puni Kōkiri contracted WOCA to assist and support whānau with the adverse impacts of COVID-19 restrictions, including providing vaccination related services. As at 18 October 2021, WOCA’s Whānau Ora partners had delivered approximately 496,000 COVID-19 vaccinations across the network.

WOCA officials and staff wanted to respond to the lower percentage of the eligible Māori population who have received COVID-19 vaccination, compared to the New Zealand population as a whole. In October 2021, WOCA Chief Executive John Tamihere asked the Ministry of Health (Ministry) to:

• enter into an information sharing arrangement with WOCA; and
• provide WOCA with relevant personal information relating to Māori who had not been vaccinated against COVID-19.

WOCA intended to use this information to reach out to unvaccinated Māori with the objective of improving lagging vaccination rates.

While the Ministry agreed to share with WOCA anonymised (to street level) mapping representations that show areas with unvaccinated communities, the Ministry declined WOCA’s request for individual identifiable data for individuals who are not vaccinated (First Decision).

WOCA commenced proceedings in the High Court to judicially review the First Decision, arguing that the Ministry did not apply the correct legal test for disclosing health information in its application of rule 11(2)(d) of the Code.

Both WOCA and the Ministry agreed that:

• it was not practicable to obtain individual authorisation due to the number of unvaccinated individuals, their range of geographic locations, and the time pressure; and
• COVID-19 was (and still is) a serious threat to public health and safety.

The Court focused its analysis on the Ministry’s approach to determining whether the proposed disclosure is necessary to prevent or lessen a serious threat to public health under rule 11(2)(d) of the Code.

WOCA was successful in the first proceeding and on 1 November 2021 the High Court directed the Ministry to retake the First Decision.

On 5 November 2021, the Ministry made a new decision on WOCA’s request. The Director-General of Health, Dr Ashley Bloomfield, accepted recommendations from Ministry officials including to again decline the request for access to all Te Ika-a-Māui/North Island individual level Māori health information sought by WOCA (Second Decision).

WOCA applied to the High Court to challenge the Second Decision, on the grounds that the Second Decision was wrong in fact and law. The Court again found errors in the Ministry’s decision-making under rule 11(2)(d) of the Code and directed the Ministry to review its decision.

The Privacy Commissioner’s role as an independent intervener in the proceeding

In the context of civil proceedings, a party that is unconnected to a dispute may apply to the Court to be heard and make submissions on relevant issues. This process is called “intervening” and allows an expert or interested party to assist the court by making legal submissions on particular points raised in the proceeding– especially if the case is of general public importance.

In New Zealand, the Privacy Act 2020 governs the disclosure and use of personal information. If that personal information relates to a person’s health and any health services that are being, or have been, provided to that person, the Health Information Privacy Code 2020 (Code) applies to the disclosure and use of that information – such as the Ministry’s information about unvaccinated Māori.

The Privacy Commissioner decided to request leave from the Court to intervene as an independent expert because the interpretation of the Code would play a central role in these proceedings. Our Office is uniquely qualified to assist the High Court in matters relating to personal information, privacy, and the Code.[1] The High Court agreed that it would be assisted by the Privacy Commissioner’s submissions and granted leave for the Privacy Commissioner to intervene. The Privacy Commissioner’s submissions were directed at the correct approach to the Ministry’s decision-making under the Code, rather than to the substance of the decision itself.

Health Information Privacy Code 2020

The Code is a legal instrument that provides a framework for the handling of health information within the health sector.

A copy of the Health Information Privacy Code 2020 is available here.

Rule 11 sets out the limits on disclosing health information. A party can generally disclose health information only for the same purpose for which that party collected the information, or where the individual concerned has authorised the disclosure (rules 11(1)(b) and (c) respectively).

However, rule 11(2) recognises that there are circumstances that enable disclosure where the relevant agency believes, on reasonable grounds, that:

1. it is not desirable or practicable for that party to obtain authorisation for the disclosure from the individual concerned;
2. the existence of a serious threat to public health or public safety, or the life or health of the individual concerned or another individual; and
3. the disclosure of the information is necessary to prevent or lessen that serious threat.

Where these circumstances apply, Rule 11(2)(d) confers a discretion on an agency to disclose specific health information rather than create a right to access the information, or an explicit  obligation to disclose it. The WOCA proceeding focussed on exercise of the Ministry’s discretion in circumstances where there is an evident threat to public health.

An evidence-based approach to the serious threat to public health exception

High Court review 1

The Privacy Commissioner submitted that, in relation to rights to privacy and to health, public agencies must take proportionate and evidence-based actions – both in relation to whether it is necessary to disclose and use the individuals’ information, and whether that disclosure and use of that information presents a realistic prospect of preventing or lessening the health risk.

The Court agreed with this position, stating that in the context of the acknowledged serious risks to individuals and public health posed by COVID-19, the Ministry needed to take an objective, evidence-based assessment of:

1. the anticipated effectiveness of disclosure and use of the requested information;
2. the anticipated adverse consequences, in terms of the protection of life and health, or other material and relevant harms, of that same disclosure and use; and
3. whether there are other options to address the health risk that lessen the privacy intrusion and resulting harms but are nonetheless effective to address the risk (including in light of the urgency of that risk), and so whether it is possible to await the outcome of lesser measures.

The Court found that the Ministry only produced generalised evidence of assessing (b) (in particular, not addressing the specific views of Māori on such effectiveness), and did not consider (a) at all.

With respect to (c), the Ministry had decided in the First Decision that anonymised mapping-level data would allow the applicants to make considerable headway in reaching unvaccinated Māori. Although the Ministry had accepted that addressing the threat posed by COVID-19 requires the Ministry to support WOCA vaccinate all individuals, the Ministry stated a preference for WOCA to spend the “coming weeks” trying to reach the unvaccinated using the anonymised data.

The Court found that the Ministry had not provided evidence showing that the anonymised information would be more effective than providing detailed personal information, or evidence of the criteria or timeframe it would rely on before providing the detailed personal information if WOCA’s use of the anonymised data was not effective in reaching unvaccinated Māori.

The Privacy Commissioner submitted that, if the decision-maker had two equally effective alternatives before it, the decision-maker could consider whether one of the available alternatives represented a ‘less privacy intrusive’ alternative. The Court accepted this submission.

On the evidence however, the Court found the Ministry’s alternative approach under review was not an equally effective alternative, concluding that the Ministry did not conduct the necessary objective, evidence-based assessment when making the First Decision.

High Court review 2

The Court affirmed that the Ministry was required to carry out an evidence-based assessment of the anticipated effectiveness of disclosing and using the additional data and concluded that the Ministry had asked itself the wrong question.  

The Ministry’s analysis focussed on WOCA’s continued progress with vaccination efforts (without the individual-level vaccination data), rather than carrying out an evidence-based assessment of the anticipated effectiveness of disclosure and use of the individual-level vaccination data that WOCA had requested. The decision paper contained no evidence-based assessment as to whether the sharing of smaller sets of personal information with “trusted locally-based organisations” would be an equally effective measure.

Nor did the Ministry carry out an evidence-based assessment (as required by the first judgment) of whether the Ministry’s alternative by providing meshblock level data is an equally effective measure for addressing the risk posed to Māori by COVID-19, in light of the urgency of the threat. Gaps in the Ministry’s analysis meant that its alternative option did not meet the urgency of the risk.

The Privacy Commissioner submitted that a decision made in urgent circumstances such as the COVID-19 outbreak does not have to be perfect or fully informed. The Court agreed, noting that an agency’s decision made under rule 11(2)(d) is “not a counsel of perfection” nor a “precedent for all time”. Rather, it is reasonable and consistent with both the Code and the Act to do what can be done within a tight timeframe given the evidence of the risks increasing over time.

Examining the legal framework for the decision-making under rule 11(2)(d), the Court also found a number of errors with the Ministry’s decision-making paper. Firstly, by implicitly adopting an “imminence” threshold by focussing on sharing data for regions where there was, at the time, already an outbreak of the Delta variant (part of Auckland and Hamilton), however the “imminence” of the threat is no longer part of rule 11(2)(d).  

Secondly, the Court endorsed the Commissioner’s submission as to the meaning of “necessary” in rule 11(2)(d) which means only “needed or required”, and that the Ministry placed too high a bar for the term “necessary” in rule 11 by implicitly applying a test of something more than “needed”.

Thirdly, the Court found that the Ministry erred in introducing an “authorisation” requirement to the rule 11 process, as a result of its overly detailed consultation process with iwi to seek views about WOCA’s request for Māori vaccination data. The Court’s finding here relied on expert evidence from Dr Carwyn Jones that tikanga did not require the Ministry to obtain iwi by iwi consent to the disclosure. As the Ministry’s decision ultimately hinged on reaching a level of comfort as to iwi views as a result of the consultation, this was not consistent with the first judgment that rights to health and privacy are not incompatible.

Overall, the exercise of the Ministry’s exercise of its discretion not to disclose the individual-level vaccination data was not consistent with the object and policy of rule 11(2)(d). The stringent rule 11(2)(d) requirements of necessity and efficacy being met, and noting the Commissioner’s submissions, the Court highlighted that other obligations such as the right to the highest attainable standard of health, may point towards disclosure.

Te Tiriti, tikanga and natural justice

High Court review 1

WOCA submitted that the government’s specific commitments to uphold the Treaty of Waitangi – Te Tiriti o Waitangi (Te Tiriti) in the COVID-19 vaccination rollout created a legitimate expectation that the Ministry would have regard to Te Tiriti and its principles in making its decision.

The Court agreed that the Ministry had committed to exercise its powers in relation to the wider COVID-19 rollout in accordance with Te Tiriti and its principles. In the context of the Crown’s repeated affirmations of its commitment to applying Te Tiriti and its principles in its COVID-19 response, the Court found that WOCA reasonably and legitimately relied on that commitment.

The Court held that the Ministry failed to determine WOCA’s specific request for the data consistently with its obligation to act in accordance with Te Tiriti. The Ministry should have assessed any proposed disclosure of health information on a case-by-case basis, ensuring that the scope and level of data shared is proportionate to each organisation’s community and whanaungatanga connections and capacity to deliver.

The Ministry had also failed to address WOCA’s request on its own terms. The Court noted that, had the Ministry made an evidence-based assessment of WOCA’s request, the Ministry would have also likely considered its obligations to Māori as a health provider and Te Tiriti partner.

As a result, the Court concluded that the Ministry did not have adequate regard to Te Tiriti and its principles as informed by tikanga.

High Court review 2

Evidence filed by WOCA from experts in tikanga noted that the highly prized taonga of health has primacy in the context of a pandemic. The experts noted that if there is taonga in data, then that taonga must give way to life and health. The evidence was not contested, and the Court accepted that here tikanga did not require the Ministry to obtain iwi by iwi consent to disclosing the information to WOCA.

The Court also accepted that the Ministry’s consultation process did not have regard to the urgency of the situation at hand. Having regard to the expert evidence as to what tikanga requires, the Court found that the Ministry did not make a decision on WOCA’s request for disclosure within a reasonable time period.

The Court also noted that WOCA was not part of the Ministry’s consultation process, the consultation process having been instrumental in the Ministry reaching its Second Decision. WOCA argued that they could have addressed many of the key points that arose from the consultation process, and that WOCA’s lack of participation meant that the Ministry had breached natural justice.

The Court accepted that if WOCA had been involved in the consultation process, they would have been address (and likely resolve) many of the important questions that the Ministry raised and ultimately found that the Ministry’s process was a breach of natural justice.

Nature of the Ministry’s discretion

The Ministry of Health argued that it ultimately had a discretion under rule 11 about whether to disclose, and in WOCA 2 that it had exercised its discretion “in the face of the credible and more Te Tiriti-compliant alternatives”.

WOCA argued that the Ministry’s discretion not to provide the requested data was limited for a number of reasons including:

1. The purpose of rule 11(2)(d) is to lessen or prevent a serious threat to public health, including in the context of the pandemic. The legislative history of the Code indicates Parliament’s clear intention that the power should be available and used to save lives.
2. The COVID-19 pandemic is a “once in a century public health crisis for Māori”, for which there is readily available modelling data to show the impact for Māori in terms of the scale of deaths, hospitalisations and infections.
3. Māori are at greater risk of adverse outcomes from COVID-19.
4. The overarching principles for the vaccination programme are equity and Te Tiriti. This includes the Crown’s duty of active protection.
5. The Crown’s current vaccination programme had not achieved equitable outcomes for Māori.
6. Disclosure of the data would help support the attainment by Māori of the fundamental right to the highest attainable standard of health, which the Crown has recognised through its ratification of the Constitution of the World Health Organization and the International Covenant on Economic, Social and Cultural Rights.
7. Parliament has recognised in the New Zealand Public Health and Disability Act 2000 that Māori face historic health disparities, and that the provision of public health services should “reduce health disparities by improving the health outcomes of Māori”.

The Privacy Commissioner submitted, and the Court accepted, that the purpose of the Act as reflected by section 3(a) was concerned with both protection and use: in other words, the Act and the Code operate as a “how to”, not a “do not do”. The Privacy Commissioner submitted that, although rule 11(2)(d) itself doesn’t require anyone to disclose information, the requirements of necessity and efficacy may demonstrate other obligations – for example, the right to the highest attainable standard of health. Citing international privacy discourse on the pandemic, data protection should not be an obstacle to saving lives and the applicable principles always allow for a balancing of the interests at stake.

Accepting that the power to disclose health information under rule 11(2)(d) is discretionary, the Court noted that, as previously stated by the Supreme Court,[2] any discretion on decision-making powers must be exercised within the scope of the legislation and consistent with its purposes. The Court acknowledged that the premise of the Privacy Act and the Code is that disclosure is permissible to address serious risks, and accepted the Commissioner’s submissions that where the stringent necessity and efficacy requirements of rule 11(2)(d) are made, then disclosure may be necessary to address an evident risk.

The Court ultimately held that the Ministry’s exercise of its discretion was not consistent with the object and policy of rule 11(2)(d).

Outcome

The Ministry released the requested information to the Whānau Ora Commissioning Agency shortly after the second judgment.

The Ministry released the information to WOCA under certain conditions, such as the requirement for WOCA to securely delete the information by the end of June 2022.

[1] The Office has previously provided guidance about the “serious threat to public health” exception and the Covid-19 pandemic here.

[2] Unison Networks Ltd v Commerce Commission [2008] NZLR 42, at [53] – [55] : A statutory power is subject to limits even if it is conferred in unqualified terms. Parliament must have intended that a broadly framed discretion should always be exercised to promote the policy and objects of Acts.